EUVD-2026-115262

In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...

CVE-2026-99220 asymmetric_keys: reject trust keys without IDs

In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...

CVE-2026-99072

A flaw was found in the Linux kernel's IPv4 networking subsystem. A local user with network administration privileges can trigger a race condition when updating routing nexthop configurations concurrently with route notifications, causing a NULL pointer dereference. This flaw can lead to a kernel...

CVE-2026-120454

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfsdecompresslzvnattr that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressedsize in an LZVN inline com.apple.decmpfs attribute so allocation fails and t...

CVE-2026-99195

A flaw was found in the Linux kernel's OpenCores Ethernet driver ethoc. During device initialization, the driver connects the physical network interface before assigning its network device operations. A local attacker capable of triggering device probing on a system configured with network traffi...

CVE-2026-114408 NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full

In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too B...

CVE-2026-114408 NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full

In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too B...

EUVD-2026-115231

In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too B...

CVE-2026-114408 NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full

In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too B...

CVE-2026-114408

Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a built with IPv6 path MTU discovery are vulnerable to a NULL pointer dereference . The vulnerability exists because the ICMPv6 Packet Too Big handler fails to verify if an entry was successfully added to the destination table. A ...

CVE-2026-99196

A flaw was found in the Linux kernel's Au1000 ethernet driver. During device probing with network traffic shaping enabled, the driver attempts to access network operations before they are assigned. This flaw allows a local user or hardware attachment event to trigger a null pointer dereference,...

CVE-2026-120454 The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfsdecompresslzvnattr that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressedsize in an LZVN inline com.apple.decmpfs attribute so allocation fails and t...

EUVD-2026-115214

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfsdecompresslzvnattr that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressedsize in an LZVN inline com.apple.decmpfs attribute so allocation fails and t...

CVE-2026-120454

The Sleuth Kit through version 4.15.0 contains a NULL pointer dereference vulnerability in the decmpfs_decompress_lzvn_attr() function. An attacker can cause a denial of service (DoS) by providing a crafted HFS+ image with a very large uncompressed_size in an LZVN inline com.apple.decmpfs attribu...

CVE-2026-120454 The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfsdecompresslzvnattr that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressedsize in an LZVN inline com.apple.decmpfs attribute so allocation fails and t...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nfp: Check resource mutex allocation nfpcppresourcefind allocates a CPP mutex handle for the matching resource-table entry and then reports success. nfpresourcetryacquire immediately passes that handle to nfpcppmutextrylock...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset causes the device to use the global tagset, whose driverdata remains NULL. Consequently, nullmapqueues falls back to the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: check endpoint DMA allocation astudcprobe allocates a coherent DMA buffer used as the backing store for endpoint buffers. astudcinitep derives per-endpoint buffer pointers from udc-ep0buf; thus, if an...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: set haveexecfd only once the interpreter is opened loadmiscbinary raises bprm-haveexecfd as soon as it sees the ‘O’ or ‘C’ flag. This happens well before it opens the interpreter. If that open fails, the flag remains...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer dereference in l3mdevl3rcv When delete l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s This may cause a null pointer dereference: Call trace: iprcvfinish+0x48/0xd0 iprcv+0x5c/0x100...